General
-
Target
de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57
-
Size
1.1MB
-
Sample
220216-2h7djafahn
-
MD5
814c507bf10fc9698a1890563e206e41
-
SHA1
a19a29b67574e38b3eb7b680f57bf6010c07fc80
-
SHA256
de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57
-
SHA512
83139e9483f1fc4f6fc48c0dc7f425430cfa7245887051b44284d914a3fcdd679e02559da90bc7b71a0a4c6e91a797313190095be9552e1da528d403ffcd23fc
Static task
static1
Behavioral task
behavioral1
Sample
de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57.exe
Resource
win7-en-20211208
Malware Config
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c610cc577e72ca6
https://mazedecrypt.top/6c610cc577e72ca6
Extracted
C:\DECRYPT-FILES.txt
maze
http://aoacugmutagkwctu.onion/6c2b0cc8a24195f4
https://mazedecrypt.top/6c2b0cc8a24195f4
Targets
-
-
Target
de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57
-
Size
1.1MB
-
MD5
814c507bf10fc9698a1890563e206e41
-
SHA1
a19a29b67574e38b3eb7b680f57bf6010c07fc80
-
SHA256
de346f177e519b7d7942407ae5719b52ba446e46bf34bd7cf176889d4c3d6c57
-
SHA512
83139e9483f1fc4f6fc48c0dc7f425430cfa7245887051b44284d914a3fcdd679e02559da90bc7b71a0a4c6e91a797313190095be9552e1da528d403ffcd23fc
-
suricata: ET MALWARE Maze/ID Ransomware Activity
suricata: ET MALWARE Maze/ID Ransomware Activity
-
Modifies extensions of user files
Ransomware generally changes the extension on encrypted files.
-
Drops startup file
-